Windows Analysis Report
9EoFkvXzGq.exe

Overview

General Information

Sample name:	9EoFkvXzGq.exe renamed because original name is a hash value
Original sample name:	2c667f2ca86b0baf1766f322fcd26c2b2fddae4348f86ef399e11eb0a58093a7.exe
Analysis ID:	1501765
MD5:	84fa0ceb37f3d3d41404044bbeedc343
SHA1:	9d3bfb93fd738c72ea3a64301522b6be47f2a6e8
SHA256:	2c667f2ca86b0baf1766f322fcd26c2b2fddae4348f86ef399e11eb0a58093a7
Tags:	120-46-149-112exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

IP address seen in connection with other malware

One or more processes crash

Sigma detected: Communication To Uncommon Destination Ports

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: 9EoFkvXzGq.exe	Virustotal: Detection: 26%			Perma Link
Source: 9EoFkvXzGq.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: 9EoFkvXzGq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: E:\Project\dy_load\x64\Release\dy_load.pdb source: 9EoFkvXzGq.exe

Networking

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49708 -> 8888

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49708 -> 120.46.149.112:8888

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 120.46.149.112 120.46.149.112

Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe

Code function: 0_2_00007FF78C061000 InternetOpenW,InternetOpenUrlA,InternetReadFile,GetModuleHandleW,GetProcAddress,VirtualProtect,CreateThread,WaitForSingleObject,

0_2_00007FF78C061000

Source: global traffic

HTTP traffic detected: GET /safekey HTTP/1.1User-Agent: myappHost: 120.46.149.112:8888Cache-Control: no-cache

Source: 9EoFkvXzGq.exe, 00000000.00000002.1478419123.00000253F75D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112/
Source: 9EoFkvXzGq.exe, 00000000.00000002.1478092647.00000072490FA000.00000004.00000010.00020000.00000000.sdmp, 9EoFkvXzGq.exe, 00000000.00000002.1478419123.00000253F7594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekey
Source: 9EoFkvXzGq.exe, 00000000.00000002.1478419123.00000253F75D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyMF
Source: 9EoFkvXzGq.exe, 00000000.00000002.1478419123.00000253F75BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyQLv
Source: 9EoFkvXzGq.exe, 00000000.00000002.1478419123.00000253F75BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyTL
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net

Detected potential crypto function

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe

Code function: 0_2_00007FF78C061000

0_2_00007FF78C061000

One or more processes crash

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7256 -s 1096

Source: classification engine

Classification label: mal56.troj.winEXE@2/5@0/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7256

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\5836afe3-0d39-4a33-a064-c1d03bdb9c8a

Jump to behavior

Source: 9EoFkvXzGq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9EoFkvXzGq.exe	Virustotal: Detection: 26%
Source: 9EoFkvXzGq.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\9EoFkvXzGq.exe "C:\Users\user\Desktop\9EoFkvXzGq.exe"
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7256 -s 1096

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: 9EoFkvXzGq.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 9EoFkvXzGq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 9EoFkvXzGq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 9EoFkvXzGq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 9EoFkvXzGq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 9EoFkvXzGq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 9EoFkvXzGq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 9EoFkvXzGq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 9EoFkvXzGq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: E:\Project\dy_load\x64\Release\dy_load.pdb source: 9EoFkvXzGq.exe

Source: 9EoFkvXzGq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 9EoFkvXzGq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 9EoFkvXzGq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 9EoFkvXzGq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 9EoFkvXzGq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49708 -> 8888

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 9EoFkvXzGq.exe, 00000000.00000002.1478419123.00000253F7602000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 9EoFkvXzGq.exe, 00000000.00000002.1478419123.00000253F75BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 9c 31 6b 7d 78 89-be 90 b3 22 a5 ab 1b 52
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 9EoFkvXzGq.exe, 00000000.00000002.1478419123.00000253F7602000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe

Code function: 0_2_00007FF78C061938 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF78C061938

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Code function: 0_2_00007FF78C061938 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78C061938
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Code function: 0_2_00007FF78C061444 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF78C061444
Source: C:\Users\user\Desktop\9EoFkvXzGq.exe	Code function: 0_2_00007FF78C061AE0 SetUnhandledExceptionFilter,	0_2_00007FF78C061AE0

Source: C:\Users\user\Desktop\9EoFkvXzGq.exe

Code function: 0_2_00007FF78C061810 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF78C061810

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
120.46.149.112	unknown	China		4847	CNIX-APChinaNetworksInter-ExchangeCN	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://120.46.149.112:8888/safekey	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown

ID:	1501765
Product:	CloudBasic
Start time:	12:53:23
Start date:	30.08.2024
Sample:	9EoFkvXzGq.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	84fa0ceb37f3d3d41404044bbeedc343
SHA1:	9d3bfb93fd738c72ea3a64301522b6be47f2a6e8
SHA256:	2c667f2ca86b0baf1766f322fcd26c2b2fddae4348f86ef399e11eb0a58093a7
Filetype:	Win64 Executable GUI (202006/5) 92.65%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9EoFkvXzGq.exe_bfb44abac2a3a6a1d14af4ba1c869bff92d4726a_bcedf73e_39336587-2635-41db-b086-6000998df6f7\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9FD9DC8B39E384E3CB5042E86AD5DAE8	6B24482BAC4C0BD987FEBCBBCB173E5EB7B472FF	67478819A141A1265132B255B547CED0995FF2EA0D1C2593E37A849C7EA9DC81
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB62C.tmp.dmp	Mini DuMP crash report, 14 streams, Fri Aug 30 10:54:25 2024, 0x1205a4 type	A816FDBDC227394583D831744ABE91E7	AC49FEDD7ABC6C1B5468D982CEFCC3A638BDBCDB	F738087AB7851CA5D1CBC6C57749DBAF01441D7F04FAF1EA73553E8F20AB858B
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6C9.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	1B40D35F1509AAA505441B35A151E429	EFB50D503511074C1090764396C7CC88888FF1B4	83E2A2EBBE52166DF9412D13F6CA39C349AFA833A35454D725A4D206697F7440
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB709.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	40BE748118CFE3B83CEC12A3D06DE833	60AEA08BA01F8DF814DFF5BBD5D0D6A0B429E413	6B3ECCCA867D5F975EA49FA57DC328327D665E824E51599089718CA211B272A1
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	FFB85BE3EAACF68A8D80E27C6C4E44DF	0A4322B8223BB31B5AE5CA550B990E3862C3D2F4	DC353798150770F2876359A38E8B55FB493DBE277D47263BEB8890B5A191264C

Windows Analysis Report
9EoFkvXzGq.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report 9EoFkvXzGq.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
9EoFkvXzGq.exe